COM Proxy Triage

Overview

This skill captures live OpenKey misses for *InProcServer32, enriches them with the corresponding machine-wide InProcServer32 DLL, and tests only CLSIDs that have a usable HKLM backing DLL.

Fresh hosts should start with scripts/Initialize-ComHijackHost.ps1 -ValidateOnly. If the FAIL rows show missing build prerequisites such as MSBuild, VC x64 toolchain, Windows SDK, or vswhere/Visual Studio Build Tools details, run scripts/Initialize-ComHijackHost.ps1 -InstallBuildTools and then rerun -ValidateOnly before full validation. Use scripts/Watch-InProcServer32Misses.ps1 for the capture step, scripts/Invoke-ComHijackProbe.ps1 for a low-level probe, scripts/Invoke-ComHijackApp.ps1 for an app-name-first single-app run, scripts/Invoke-ComHijackSurvey.ps1 for batch runs, and scripts/Get-ComHijackOverlap.ps1 to analyze the running JSONL database. Read references/workflow.md when you need the concrete test loop, registry handling, or Koppeling build notes.

Workflow

1. Run the watcher from an elevated PowerShell session and filter to the target process with -ProcessName.
2. Keep only HKCU InProcServer32 misses where MachineInprocServer32 is present.
3. Deduplicate by Clsid.
4. Build or reuse a proxy DLL that clones the HKLM target DLL's exports and runs the chosen payload.
5. Override HKCU\Software\Classes\CLSID\{CLSID}\InProcServer32, launch a fresh target process, and check whether the payload fired.
6. Restore the prior HKCU state after every test. If the key did not exist before, remove it.
7. Resolve installed apps by name first. Use assets\apps.json as an override cache when present, not as a required source of truth.

Rules